I wonder if anyone can offer any advice in relation to an issue we have using Zeek (LTS 4.0.3), and a Myricom 10G-PCIE2-8C2-2S. The Myricom card is currently on a SPAN port from a Juniper QFX, albeit we’re planning to move to a Profitap fibre TAP soon.
We’ve compiled Zeek using sources in order to accommodate the snf driver (e.g ./configure --with-pcap=/opt/snf/), and it works well using the following node.cfg configuration -
Our issue, is that when we try to filter traffic, either using ZeekArgs, or redef PacketFilter::default_capture_filter, workers crash within a few minutes of starting the process.
We’re trying to use a simple capture filter like -
ZeekArgs = -f "not dst host 10.100.48.5 and not dst host 10.100.40.78”
redef PacketFilter::default_capture_filter = "not host 10.100.48.5";
The output of the crash diag is attached, but in short, we experience -
Program terminated with signal SIGSEGV, Segmentation fault.
#0 zeek::packet_analysis::Ethernet::EthernetAnalyzer::AnalyzePacket (this=0x5560e04be680, len=808, data=0x41d853675b0719a8 <error: Cannot access memory at address 0x41d853675b0719a8>, packet=0x5560e171b9c8) at /root/zeek-4.0.3/src/packet_analysis/protocol/ethernet/Ethernet.cc:33
33 if ( data == 0x89 && data == 0x03 )
[Current thread is 1 (Thread 0x7f90ea7172c0 (LWP 4830))]
If we remove the BPF or capture filter, the processes stay online consistently.
Any advise on how to diagnose this would be greatly appreciated.
I haven't redef'd a variable from the command line since Bro 2.5, now
running Zeek 4.2.0-dev.78 and I'm getting the following error:
*error in <params>, line 1: syntax error, at or near "redef" or end of file
Example is super simple for trying to understand what I'm doing wrong -
*const s1 = "world" &redef;*
*print fmt("hello %s", s1);*
On the command line:
> zeek ./test.zeek s1="zeek"
* error in <params>, line 1: syntax error, at or near "redef" or end of
If I modify the script as follows it works fine:
*const s1 = "world" &redef;redef s1="zeek";*
*print fmt("hello %s", s1);*
> zeek ./test.zeek
What am I missing??
Hi folks, I am currently struggling how to analyse single big (500MB-1GB+) pcap file with zeek in a short time. I am using standalone mode of zeek and with this command: zeek -Cr sample_500MB.pcap local it took about 1.40min which is a bit too long for my needs...
What do you advise, how can I get zeek -r multithreadded behaviour like? Documentation says, use cluster with several workers (even on one node) but I am not sure if you can read pcap in cluster mode? Another option is tcpreplay and let workers generate logs in cluster mode?
So what do you guys advise, I am doing only offline pcap analysis with single 500+MB pcap and zeek should use ideally 4-6 cores instead of one.
I am currently using the Apache Kafka plugin to send logs to the Kafka
server. The current setup is designed to use the plugin to send each zeek
log(5 log streams) to a specific kafka topic as described here
But the requirement now is to:
1 - Continuing to send the existing zeek logs to their specific topics as
2 - Send all the other *selected* log streams to just one topic name on
I have tried to set this up but it does not seem to work. Is this possible
Appreciate your help!
Wednesday 15 Sep, 2021 is going to be a busy, yet fun day. We have a
virtual meetup AND we'll be recording another Zeek Webinar. Details below
on how you can participate in each of these events.
- 15 September 2021 – VIRTUAL ZEEK MEETUP – 10am – 11:30am Pacific/12pm
– 1:30pm Eastern – GUEST SPEAKER – *Richard Bejtlich, *
https://www.taosecurity.com/, will be our speaker at this event. He’ll
be speaking about, “How to monitor your wireless network?” Register to
attend this meetup at:
- 15 September 2021 – ZEEK WEBINAR SERIES: How Zeek and Suricata work
together: Complementary not Competitive! – 11am Pacific/2pm Eastern – On
the Zeek Slack workspace and other areas in the Zeek Community, we are
often asked, “Should I use Zeek or Suricata to monitor my network?” In this
webinar, *Alex Kirk* discusses how Zeek and Suricata can be used
together and how they are complementary not competitive tools. This webinar
is free, but registration is required. Register at:
Please let me know if you have any questions.
I recently opened a pull request at https://github.com/zeek/zeek/pull/1717 <https://github.com/zeek/zeek/pull/1717> to reformat the entire Zeek code base using clang-format. Clang-format 12.0.1 (and 13) recently gained more support for the Whitesmiths formatting style that Zeek uses. Reformatting against some sort of standard has been on the Zeek roadmap for a while. This email is to notify everyone that we’re going to merge this PR in the next week or so. It shouldn’t cause any breakage to plugins built out-of-tree, but will likely cause breakage for people that have forks of Zeek or are working on long-lived branches. If there’s any concerns with us merging this, please comment on the PR so we can resolve those concerns. Thanks!
Just a quick reminder that the monthly Zeek Community call will start in
about 30 mins at 1pm ET.
The meeting will be 30 mins or less and cover the following:
- Zeek LT Update
- Zeek Technical Update
- Zeek Subgroup Updates
- ZeekWeek 2021
Register to attend at: